> ## Documentation Index
> Fetch the complete documentation index at: https://docs.usetero.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Datadog

> Create read-only Datadog credentials for Tero

Connect Datadog by creating read-only credentials and sharing them with Tero. This lets Tero review log telemetry, build service and log-event context, and analyze ingestion without changing anything in Datadog.

## What to create

Tero needs two Datadog credentials:

* An API key named `Tero`
* An application key owned by a service account with Datadog's `Read-Only` role

Use the Datadog UI or `pup` CLI to create both credentials.

## Create credentials

<Tabs>
  <Tab title="Datadog UI">
    <Steps>
      <Step title="Create an API key">
        In Datadog, go to <strong>Organization Settings > API Keys</strong>. Create a new key named <code>Tero</code>.
      </Step>

      <Step title="Create a service account">
        Go to <strong>Organization Settings > Service Accounts</strong>. Create a service account named <code>Tero</code> and assign it the <code>Read-Only</code> role.
      </Step>

      <Step title="Create an application key">
        Open the <code>Tero</code> service account. Under <strong>Application Keys</strong>, create an application key and copy it. Datadog shows the application key secret once.
      </Step>
    </Steps>
  </Tab>

  <Tab title="Pup">
    Use the same Datadog site your account normally uses. Replace <code>\<DATADOG\_SITE></code> with your Datadog site, such as <code>datadoghq.com</code>, <code>us3.datadoghq.com</code>, <code>us5.datadoghq.com</code>, <code>datadoghq.eu</code>, <code>ap1.datadoghq.com</code>, or <code>ddog-gov.com</code>.

    <Steps>
      <Step title="Install Pup and authenticate">
        ```bash theme={null}
        brew tap datadog-labs/pack
        brew install datadog-labs/pack/pup

        pup auth login --site <DATADOG_SITE>
        pup users roles --output table
        ```
      </Step>

      <Step title="Create an API key">
        ```bash theme={null}
        pup api-keys create --name Tero --output json
        ```

        Copy the API key value from the output.
      </Step>

      <Step title="Create the service account request">
        Create `tero-service-account.json` with the role ID for Datadog's `Read-Only` role.

        ```json theme={null}
        {
          "data": {
            "type": "users",
            "attributes": {
              "name": "Tero",
              "email": "tero@datadoghq.com",
              "service_account": true
            },
            "relationships": {
              "roles": {
                "data": [
                  {
                    "id": "<READ_ONLY_ROLE_ID>",
                    "type": "roles"
                  }
                ]
              }
            }
          }
        }
        ```
      </Step>

      <Step title="Create the service account">
        ```bash theme={null}
        pup users service-accounts create --file tero-service-account.json --output json
        ```

        Copy the service account ID from the output.
      </Step>

      <Step title="Create the application key request">
        Create `tero-application-key.json`.

        ```json theme={null}
        {
          "data": {
            "type": "application_keys",
            "attributes": {
              "name": "Tero"
            }
          }
        }
        ```
      </Step>

      <Step title="Create the application key">
        ```bash theme={null}
        pup users service-accounts app-keys create <SERVICE_ACCOUNT_ID> --file tero-application-key.json --output json
        ```

        Datadog shows the application key secret once. Copy it before closing the output.
      </Step>
    </Steps>
  </Tab>
</Tabs>

## Share the credentials with Tero

Send your Tero contact the Datadog API key, application key, and Datadog site. Tero uses those read-only credentials to start analysis.

## Related pages

* [Issues](/issues/overview)
* [Policies](/policies)
* [Log events](/master-catalog/log-events)